CVE-2026-0911

CVE-2026-0911 — Hustle モジュールインポート PoC WordPress プラグイン Hustle wordpress-popup、WPMU DEV の CVE-2026-0911 に関する、認証を必要とする モジュールインポート エンドポイント経由のアップロード動作をテストする 調査 / ペンテスト支援 ツールです。 このリポジトリまたはファイルセット内の CVE-2026-0911.py スクリプトは、所有している 、または書面による許可を得てテストしている システムでのみ使用してください。 概要（脆弱性の仕組み）...

CVE-2026-80440 Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...

CVE-2026-80440 Hustle < 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders

The Hustle WordPress plugin before 7.8.14.2 does not prevent shortcodes in submitted form values from being executed when it substitutes those values into the message it returns after submission, because the guard it applies can be defeated by nesting, allowing unauthenticated users to run any...

PT-2026-4616

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the action import module function in all versions up to, and including, 7.8.9.2. This makes it possible for authenticated attackers,...

EUVD-2025-15259

Malicious code in bioql PyPI...

CVE-2024-8492

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-8492

The Hustle WordPress plugin through 7.8.5 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...